Internal Revenue Service: Individual Taxpayer Indentification	 
Numbers Can Be Improperly Obtained and Used (10-MAR-04, 	 
GAO-04-529T).							 
                                                                 
The Internal Revenue Service (IRS) issues Individual Taxpayer	 
Identification Numbers (ITINs) to those who are not eligible for 
a social security number (SSN) from the Social Security 	 
Administration (SSA). ITIN-related concerns include whether any  
weaknesses in IRS's controls would allow ITINs to be issued and  
used for illegal purposes and possible security breaches, whether
employers are confused about their responsibilities to IRS, SSA, 
and the Department of Homeland Security (DHS) for identifying	 
their employees, and how IRS, SSA, and DHS share data when	 
illegal resident aliens receive ITINs. Because of these concerns,
GAO was asked to: (1) describe why IRS created the ITIN, (2)	 
describe IRS's processes and controls for issuing ITINs, (3) do a
limited test of IRS's processes and controls, and (4) describe	 
certain concerns and problems for employers and government	 
agencies when ITINs are issued to illegal resident aliens.	 
-------------------------Indexing Terms------------------------- 
REPORTNUM:   GAO-04-529T					        
    ACCNO:   A09464						        
  TITLE:     Internal Revenue Service: Individual Taxpayer	      
Indentification Numbers Can Be Improperly Obtained and Used	 
     DATE:   03/10/2004 
  SUBJECT:   Social security number				 
	     Taxpayers						 
	     Personal income taxes				 
	     Tax administration systems 			 
	     Interagency relations				 
	     Internal controls					 
	     Resident aliens					 
	     Identity verification				 
	     IRS Personal Identification Number 		 
	     Program						 
                                                                 

******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO Product.                                                 **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
******************************************************************
GAO-04-529T

United States General Accounting Office

GAO Testimony

Before the Subcommittee on Oversight and Social Security, Committee on
Ways and Means, House of Representatives

For Release on Delivery Expected at 10 a.m. EDT Thursday, March 10, 2004

INTERNAL REVENUE SERVICE

 Individual Taxpayer Identification Numbers Can Be Improperly Obtained and Used

Statement of Michael Brostek, Director, Tax Issues

                                       a

GAO-04-529T

Highlights of GAO-04-529, a report to a testimony to the House Ways and
Means Subcommittees on Oversight and on Social Security

The Internal Revenue Service (IRS) issues Individual Taxpayer
Identification Numbers (ITINs) to those who are not eligible for a social
security number (SSN) from the Social Security Administration (SSA).
ITIN-related concerns include whether any weaknesses in IRS's controls
would allow ITINs to be issued and used for illegal purposes and possible
security breaches, whether employers are confused about their
responsibilities to IRS, SSA, and the Department of Homeland Security
(DHS) for identifying their employees, and how IRS, SSA, and DHS share
data when illegal resident aliens receive ITINs.

Because of these concerns, GAO was asked to: (1) describe why IRS created
the ITIN, (2) describe IRS's processes and controls for issuing ITINs, (3)
do a limited test of IRS's processes and controls, and (4) describe
certain concerns and problems for employers and government agencies when
ITINs are issued to illegal resident aliens.

Although GAO is not making recommendations, this hearing is a useful venue
for Congress to consider whether to provide IRS, SSA, and DHS guidance on
how to address concerns about ITIN issuance controls and policies for
dealing with illegal resident aliens.

March 2004

INTERNAL REVENUE SERVICE

Individual Taxpayer Identification Numbers Can Be Improperly Obtained and Used

IRS created the ITIN in 1996 to improve tax administration. IRS needed a
better way to identify the tax reporting of those who could not obtain an
SSN to use on tax returns and other tax documents. The cumulative number
of ITINs issued exceeded 7 million by the end of 2003.

IRS receives ITIN applications from the mail, applicants walking into IRS
offices, and authorized non-IRS entities. In December 2003, IRS made
changes to improve its ITIN controls. However, IRS remains limited in its
ability to verify applicants' identities. For instance, IRS staff does not
see most applicants and IRS does not verify the validity of documents.

Before December 2003, GAO staff obtained an ITIN by submitting bogus
documents through the mail and used the ITIN to open a bank account and
obtain an ATM card. Staff also fabricated an ITIN and used it to obtain a
voter registration card. While limited, this test indicates that IRS's
controls could be bypassed and that an ITIN could be used for nontax
purposes. Despite the December changes, the weaknesses GAO exploited
remain. Resolving these limitations could be challenging.

IRS has concluded that most resident aliens who have ITINs and earn wage
income are not legally employed in the United States. Given this context,
the use of ITINs raises various issues. Employers have raised concerns
that when they identify employees and their work eligibility, they could
have conflicting obligations to IRS, SSA, and DHS. These concerns appear
to be largely unfounded if employers do what is specifically required.
Data sharing-especially of IRS data-may help DHS to target immigration
enforcement, but, among other things, officials cited legal restrictions
and the potential for employment to be hidden from tax administrators as
affecting their decisions about sharing data.

Number of ITINs Issued Annually and Cumulative Total, Calendar Years 1996
Through 2003

www.gao.gov/cgi-bin/getrpt?GAO-04-529T.

To view the full product, including the scope and methodology, click on
the link above. For more information, contact Michael Brostek at (202)
512-9110 or [email protected].

Messrs. Chairmen and Members of the Subcommittees:

I am pleased to participate in the hearing today on various issues related
to the Individual Taxpayer Identification Number (ITIN) issued by the
Internal Revenue Service (IRS). As you requested, my statement today
describes why IRS created the ITIN, the processes and controls IRS has in
place for issuing ITINs, the results of our limited test of the controls
over issuing an ITIN, and certain concerns and problems for employers and
government agencies that ensue when ITINs are issued to illegal resident
aliens.1

IRS issues ITINs to individuals who are required to have a U.S. taxpayer
identification number (TIN) but who are not eligible to obtain a social
security number (SSN) from the Social Security Administration (SSA). An
ITIN has nine digits formatted like an SSN (NNN-NN-NNNN) but beginning
with the number "9".2 IRS issues ITINs for tax processing purposes only.
Having an ITIN does not affect a holder's immigration status, or authorize
the holder to work or receive Social Security benefits.

In requesting this testimony, you sought a better understanding of the
vulnerabilities in the ITIN issuance process, including whether weaknesses
allow ITINs to be issued and used for illegal purposes and possible
security breaches. You also expressed interest in the extent to which
employers may be confused by their responsibilities vis-`a-vis IRS, SSA,
and the Department of Homeland Security (DHS) in ensuring the identity of
their employees, and whether federal agencies are sharing information to
deal with illegal resident aliens who may be issued ITINs.

Today's statement is based on interviews, reviews of agency documents and
various publications, and limited tests of the ITIN issuance controls.
Specifically, to address the four areas, we interviewed officials from IRS
including the Taxpayer Advocate Service, SSA, and the Departments of the
Treasury, Homeland Security, and Labor. We reviewed documents from these
agencies as well as other literature. In addition, our Office of Special

1In this testimony, we use the term alien to mean a foreign-born
individual who has not been naturalized and is still a subject or citizen
of a foreign country. A resident alien is someone meeting this definition
but also considered a resident of the United States for tax purposes, as
described later in this testimony. A nonresident alien does not reside in
the United States, but may have a need to interact with IRS. For this
testimony, we defined an illegal resident alien is a resident alien who is
not legally in the United States and also may refer to them as illegal
aliens, undocumented workers, or unauthorized resident aliens.

2SSA officials said that they also receive other identification numbers
that start with "9".

Investigations (OSI) did limited testing of IRS's controls to determine
whether it could fraudulently obtain an ITIN by mailing or presenting
bogus identity documents to IRS. OSI used an IRS-issued ITIN and a fake
ITIN it generated for nontax purposes. We did our work in Washington, D.C.
from September 2003 through February 2004 in accordance with generally
accepted government auditing standards and we performed our investigative
work in accordance with standards prescribed by the President's Council on
Integrity and Efficiency.

Our results in these four areas showed that:

o 	IRS created the ITIN in 1996 to improve tax administration. IRS needed
a better way to identify and track the tax reporting of noncitizens that
could not obtain an SSN for use when filing tax returns. Beyond the filing
of tax returns, ITINS have other legitimate tax uses, such as for filing
documents other than tax returns and for claiming benefits related to a
tax treaty. According to IRS, most ITINs have been used at least once on a
tax return and ITINs also have been used for other legitimate tax
purposes.

o 	IRS made changes to improve its processes for issuing ITINs in December
2003, but continues to have limited controls to verify the identity of
ITIN applicants. For example, the majority of ITIN applicants apply by
mail and IRS cannot be sure the applicant is the same individual described
by the documentation submitted. IRS also does not verify with third
parties the validity of the documents submitted with the ITIN
applications.

o 	Before IRS changed its procedures in December, we obtained an ITIN by
applying with bogus documents through the mail. We also created a bogus
ITIN without applying to IRS. Using the IRS-issued ITIN, we opened a bank
account and obtained an ATM card. We used the bogus ITIN to obtain a voter
registration card. While very limited, this test illustrates weaknesses in
IRS's ITIN controls, which have not been completely addressed by the
changes made in December, and shows that ITINs can be used for nontax
purposes, such as blending into society under a false identity. Resolving
the continuing limitations in IRS's ITIN issuance controls would be
challenging.

o 	Although precise data are not available, hundreds of thousands of ITINs
are issued to aliens who subsequently earn wage income. IRS and the
Treasury Inspector General for Tax Administration (TIGTA) have

concluded that these individuals are illegal resident aliens. Given this
context, employers have raised concerns about potentially conflicting
obligations to IRS, SSA, and DHS when they identify employees and their
work eligibility. These concerns appear to be largely unfounded if
employers do what is specifically required. Sharing IRS data with DHS may
provide enhanced information to target enforcement of immigration laws,
but to differing degrees, officials cited such factors as legal
restrictions and the potential for employment to be hidden from tax
administrators as affecting their decisions about whether and how to share
data.

Background	IRS requires a unique TIN to process any tax return or
tax-related document, and associate the return or document with a
taxpayer's history. A TIN allows IRS to better manage a host of tax
administration functions- such as crediting tax payments, and verifying
compliance in filing returns, reporting income, and paying taxes. IRS also
needs it to process information returns filed by employers and financial
institutions to report certain types of payments (e.g., wages or interest)
made to individuals.

One type of TIN is the SSN, which SSA is authorized to issue to United
States citizens, aliens allowed to work in the United States, or others,
in limited cases, for nonwork purposes. For example, according to SSA, if
an applicant only needs an SSN to obtain certain government benefits as
specified in SSA regulations, SSA must issue an SSN and social security
card but the card specifically states that it is not valid for work
purposes. Individuals must use an SSN when filing a required tax return,
unless they cannot legally obtain an SSN.

For those who cannot obtain an SSN but need a TIN for tax purposes, IRS
created the ITIN. IRS's 2003 training manual on ITINs identifies such
individuals, as shown below.

o 	An alien who does not reside in the United States and who is filing a
U.S. tax return to (1) claim a tax treaty benefit, (2) claim a tax refund,
or (3) file a joint tax return with a spouse who is a U.S. citizen or
resident.

o 	An alien who lives in the United States and who is filing a U.S. tax
return.

o 	Individuals claimed on a U.S. tax return as a (1) dependent, or (2)
spouse.

An alien is a resident for tax purposes if the individual (1) is a lawful
permanent resident (green card test3) in the United States for any time
during the year, (2) is present in the United States for 31 or more
calendar days during the current year and for a substantial time-183 or
more weighted days-during a 3-year period weighted toward the current year
(substantial presence test), or (3) elects to be treated as a U.S.
resident (first-year election test). 4

IRS does not believe that it has the legal authority to distinguish
between legal and illegal resident aliens for tax purposes. Individuals
who meet the definition of a resident alien are generally taxed in the
same manner as U.S. citizens and holders of green cards, meaning that they
are taxed on their worldwide income. One exception is that resident aliens
who have ITINs are ineligible to claim the refundable earned income tax
credit, which requires a valid SSN issued for work purposes. A nonresident
alien is subject to tax on income from U.S. sources but generally not on
foreign source income.

  IRS Created the ITIN to Improve Tax Adminstration

IRS created the ITIN in July 1996 to improve tax administration for
individuals who were ineligible to obtain an SSN. IRS needed a better way
to identify and track tax filing and reporting by these individuals and by
employers and financial institutions that file other tax documents related
to the individual's income.

Each individual taxpayer is to use a unique and permanent TIN, which
allows IRS to associate their filed tax returns with their tax records and
with information returns on payments made to them, and to more effectively
use programs to enforce tax filing and reporting compliance. For
individuals who lacked an SSN, IRS did not have a permanent TIN to use in
tracking their tax obligations and history prior to the ITIN.

Prior to July 1996, IRS used a system of temporary TINs when a taxpayer
did not have an SSN to facilitate one-time processing of a tax return. The
temporary TIN was assigned to a return filed without an SSN rather than to
a taxpayer. However, IRS had to post returns with temporary TINs to the

3A green card is an identity document issued to lawful permanent residents
by DHS that attests to the permanent residence status of an individual in
the United States.

426 U.S.C. S:7701(b)(1)(A).

invalid segment of IRS's masterfile because these returns could not be
associated with a valid taxpayer account.5 Posting to the invalid segment
created problems for IRS enforcement programs, such as negating income
verification through document matching. Because the temporary TINs were
unique to IRS, IRS could not easily match the amounts of income and
withheld taxes reported on these tax returns against information returns
submitted by third parties to report such amounts.

In 1995, we reported that accounts in the invalid segment had more than
doubled the growth rate compared to those in the valid segment from 1986
through 1994. We also reported that IRS refunded $1.4 billion for tax year
1993 returns posted to the invalid segment. 6 Although no one knows how
much of this $1.4 billion may have been erroneously refunded, the risk was
higher because IRS had less certainty about these filers' identities
absent a valid TIN and about the accuracy of their returns absent the
ability to match a filed return with third-party data.

Also, prior to December 1996, SSA was issuing "nonwork" SSNs to
individuals who had tax obligations but were not authorized to work or
were not otherwise part of the social security system. With the growth in
the earnings suspense file-SSA records that could not be associated with a
wage earner, SSA decided to reduce the number of nonwork SSNs. Starting in
December 1996, SSA tightened restrictions on who could apply for a nonwork
SSN.

In response to these events and the needs of tax administration, IRS
created the ITIN as a permanent TIN assigned to individuals who needed to
file a tax return but were ineligible to obtain an SSN. Among other
things, IRS was concerned that information returns could not be matched
with a tax return. Such returns report third-party payments made to those
such as nonresident aliens who invested in companies or real estate in the
United States, or received rent and royalty payments.

5The masterfile is a record of transactions in a taxpayer's account. If a
taxpayer has a TIN, IRS posts account information to the valid segment of
the masterfile. Otherwise, IRS posts the information to the invalid
segment.

6United States General Accounting Office, Tax Administration: IRS Could Do
More To Verify Taxpayer Identities, GAO/GGD-95-148 (Washington, D.C.: Aug.
30, 1995).

IRS issued its first ITINs in July 1996. Figure 1 shows that IRS has
issued over 7.2 million ITINs through December 2003 and over 1 million
ITINs annually in more recent years.7

Figure 1: Number of ITINs Issued Annually and Cumulative Total, Calendar
Years 1996 to 2003

Number of ITINs (in millions) 8

7

6

5

4

3

2

1

0 1996 1997 1998 1999 2000 2001 2002 2003

Number issued annually

Cumulative total

Source: GAO analysis of IRS data.

Note: 1996 does not cover a full calendar year because the ITIN program
began in July 1996.

According to IRS, most of the ITINs issued have been used for legitimate
tax purposes such as on tax returns and other tax-related documents. IRS
analysis in 2003 showed that about 75 percent of the ITINs issued since
its inception through September 2003 have been used at least once on filed
tax returns as a required identification number. The actual portion of
ITINs used for tax purposes would be higher than 75 percent if IRS had
computed the frequency of uses beyond return filing such as to: (1) obtain
treaty benefits or exemptions from withheld tax, and (2) file information
returns

7IRS issued 60,682 ITINs in 1996; 1,363,071 in 1997; 566,745 in 1998;
615,413 in 1999; 818,392 in 2000; 1,088,837 in 2001; 1,493,284 in 2002;
1,229,097 in 2003; and 77,759 through Feb. 13, 2004.

on payments made, such as Forms W-2 (Wage and Tax Statement) for wage
income. IRS does not track the frequency of these other uses.

  IRS Provides Multiple Ways to Obtain an ITIN but Its Controls to Verify the
  Correctness of Issuance and Use Are Limited

IRS provides multiple avenues to apply for an ITIN, all of which result in
IRS reviewing the applications and documents to establish an individual's
identity. However, IRS's controls over the issuance and use of ITINs are
limited. IRS made changes to improve its controls in December 2003, but
the changes did not fully address the control limitations. Among other
limitations, IRS does not see most applicants, documents are not verified
with third parties, and few staff can translate or verify foreign language
documents.

ITIN Application Process	Individuals apply for ITINs by filing a Form W-7
(Application for IRS Individual Taxpayer Identification Number) with IRS.
As of December 17, 2003, applicants must provide the tax return for which
an ITIN is needed, and documentation and a photograph to verify their
identity and foreign status, such as a passport, driver's license, or
identity card.

The ITIN application can be mailed to IRS, submitted at an IRS walk-in,
taxpayer assistance center, or submitted through an acceptance agent. Each
way has slightly different procedures and requirements.

o 	An applicant can mail Form W-7 and supporting documents to the
Philadelphia Service Center (campus). The documents must be originals or
notarized copies. Under IRS procedures, the documents are to be examined
by an ITIN unit employee and originals are to be returned to the applicant
while IRS is to retain notarized copies. According to IRS, this mail
option historically accounts for about 70 percent of the applications.

o 	An applicant can apply at an IRS taxpayer assistance center that
provides walk-in assistance. An IRS employee is to review the application
and documents submitted. If the employee deems the documented proof to be
satisfactory, the employee is to make an appropriate notation on Form W-7,
copy the documents, and return them to the applicant. The employee is to
transmit Form W-7 and the copied documents to Philadelphia for final
review and issuance of the ITIN. If the employee deems the documents to be
suspect or unsatisfactory, the employee is to return them to the
applicant.

According to IRS, about 20 percent of applicants use this walk-in option.

o 	An applicant can use the services of an IRS-approved acceptance agent.8
Agents include colleges, financial institutions, and accounting firms, and
can be located outside of the United States. Acceptance agents help
prepare a Form W-7 and must submit this form and related documentation to
IRS. Certified acceptance agents are authorized to also certify whether
the documented proof is adequate. They are required to keep copies of the
documents for 3 years after making an appropriate notation on the Form W-7
and forwarding it to IRS. Less than 5 percent of applicants use an
acceptance agent-whether or not certified.

Limited Controls Over ITIN Issuance

IRS has limited controls to verify ITIN applicants' identities. Among the
key limitations in the issuance process are that IRS employees do not have
to see the applicant in most cases to verify their identity, applicants'
documents are not verified with third parties, and IRS has few staff able
to translate or verify foreign language documents.

IRS's ability to establish the applicant's identity is hindered when IRS
employees do not see the applicant as they review identifying information
and photographs submitted. This is the case for applications that are sent
through the mail, which account for 70 percent of applications. A similar
problem can arise for "walk in" applications because third parties can
submit a Form W-7 for ITIN applicants. As long as the Form W-7 is signed
and documentation is provided, IRS does not require applicants to appear.

IRS employees may have difficulty in determining the validity of an
unfamiliar document submitted with a Form W-7 to verify identity. An IRS
letter to state motor vehicle departments in August 2003 indicated that
IRS generally accepts documents submitted with a Form W-7 at face value
without validating their authenticity with issuing agencies, or, as
discussed above, requiring applicants to appear in person. As of December
17, 2003, IRS listed 13 types of documents that could be used, such as a
passport,

8A list of acceptance agents that are available to the general public is
available on the IRS Web site (www.irs.gov).

foreign voter registration card, visa, or U.S. or a foreign driver's
license.9 Prior to that, IRS had listed 40 types of documents. IRS reduced
the list, in part, because of the difficulty for IRS employees who see low
volumes of Forms W-7 to know all types of documents.

Even with this reduction in the number of acceptable types of documents,
IRS employees still can encounter many variations to consider for each
type of document. For example, an IRS research study completed in October
2003 indicated that 17 countries accounted for 85 percent to 87 percent of
the ITIN applicants during 1999 through 2001. In each of these years,
Mexican citizens accounted for 54 percent to 57 percent of the ITIN
applications submitted to IRS. The remaining ITIN applicants can come from
many other countries. Each country could have unique formats for each type
of acceptable document, which may be unfamiliar to IRS employees.

IRS employees have limited capability to interpret documents submitted in
a foreign language. IRS does not track how many documents are submitted in
a foreign language but as noted above, ITIN applicants can come from many
countries. As of October 2003, 10 of the 230 employees at the ITIN
Philadelphia site were bilingual---6 in Spanish, 1 in Chinese, 1 in
Korean, 1 in Japanese, and 1 in Ukrainian/Polish, according to IRS.

Nor does IRS generally require ITIN applicants to provide translated
copies of documents submitted in a foreign language. According to the Form
W-7 instructions, the applicant may be required to provide a certified
translation of the foreign language document to obtain an ITIN. IRS states
that it will attempt to translate any foreign documents provided. If IRS
cannot translate it, IRS's procedure is to ask the applicant for the
required translation.

Even if documents can be read, some IRS employees do not have much
experience in judging whether the documents are genuine. According to IRS
officials, much of this knowledge comes from on-the-job
experience-employees that see more documents are more likely to be able to
spot an invalid or bogus document. Each IRS employee that provides
taxpayer assistance receives the standard 8-hour IRS training on ITIN,
including

9Other documents include an identification card issued by U.S. or foreign
military agencies, a state, or a national government; a DHS photo
identification; birth certificate; and medical or school records for
dependents.

document identification and validation, given to all employees when
hired-whether the employee handles ITIN applications in Philadelphia or at
a walk-in site.

IRS Is Attempting to Improve ITIN Issuance Controls

Knowing of weaknesses in its ITIN processes and controls, IRS has made
some changes to improve its controls and is considering other
improvements. IRS's concern about the large number of ITINs issued
prompted creation of a task force in 2002 to conduct an in-depth review of
ITINs. The task force identified many problems and recommendations in its
September 2002 final report. IRS designated 22 recommendations as high
priority, and created an ITIN office to study their feasibility and
oversee any implementation.

We did not have time to review the implementation status of all 22
recommendations but know that action has been taken on some of the
recommendations. For example, IRS has started a campaign to educate
states, employers, financial institutions, and other government agencies
on the appropriate use of ITINs. To this end, IRS sent letters in August
2003 to the directors of all state motor vehicle departments asking them
to not accept ITINs for drivers' license purposes. IRS also has considered
legislative proposals to make ITIN use illegal for nontax purposes, and to
assess information return penalties for improper Form W-7 filings.

IRS announced three other recommendations that took effect on December 17,
2003. First, to help eliminate the nontax use of ITINs, the applicant will
have to show a federal tax purpose for seeking the ITIN. A Form W-7
application without proof that an ITIN is needed for federal tax purposes
is to be rejected. IRS is requiring taxpayers to attach the tax return for
which an ITIN is needed to a Form W-7.10 Nonresident aliens who need an
ITIN for tax purposes other than filing a tax return, such as to obtain
tax treaty benefits, will need to prove ownership of the asset that is
eligible for a benefit when they file the Form W-7. Second, as mentioned
earlier, IRS reduced to 13 from 40 the number of documents that it will
accept as proof of identity to obtain an ITIN. Third, IRS will no longer
issue an ITIN card, reasoning that the card could be mistaken for an SSN
card. Rather, it will issue an authorization letter. Although these
changes appear to have the potential to better ensure that ITINs are
issued for valid tax-related

10Applicants who are not authorized to work but report wage income on the
tax return could still qualify for an ITIN, as discussed elsewhere in this
testimony.

purposes, we do not know how much these changes may improve IRS's controls
over issuance.

Weaknesses in ITIN Controls Can Contribute to Tax Fraud

Weak controls over the issuance of ITINs can contribute to tax fraud by
individuals seeking to obtain a tax refund that is not truly owed to them.
For example, if an individual uses bogus documentation to obtain an ITIN
under a false identity, that individual could use that ITIN to file
fraudulent tax returns that claim tax refunds. In such situations, the
individual could attach a bogus Form W-2 to the tax return to create
support for any wages claimed on the fraudulent return, even though ITIN
holders generally are not authorized to have SSNs and earn wages in the
United States.11

IRS has not measured how often such tax fraud schemes related to ITINs
have been used but has some anecdotal data. IRS has found that ITINs have
been used in schemes that resulted in millions of dollars in fraudulent
tax refunds. For 1999 through 2003, IRS found 12,241 tax returns, that
used an ITIN with bogus Form W-2s attached that claimed refunds in excess
of $22.1 million. IRS was able to stop $18 million of these refunds. One
scheme in California over these four years accounted for 9,664 of these
false returns.

  IRS's ITIN Controls Can Be Circumvented to Obtain ITINS and Use Them for
  Non-tax Purposes

Before IRS instituted the changes during December 2003, we did a limited
test to assess the security of the ITIN program controls. We attempted to
improperly obtain and use ITINs for nontax purposes during September
through November 2003. We were able to obtain an ITIN from IRS using fake
identity documentation and use this ITIN as well as a bogus ITIN we
created for nontax purposes. Although IRS changed its procedures after we
obtained and used the ITINs, the changes made do not fully address the
weaknesses we exploited, such as IRS's limited ability to verify the
validity of documents. Overcoming these weaknesses would be challenging.

We applied for an ITIN using two methods. First, we mailed an ITIN
application to IRS's Philadelphia Service Center using a bogus foreign
birth certificate as proof of identity. Second, we submitted bogus foreign

11By analyzing a sample of tax returns filed in tax years 1999 and 2000
with an ITIN for the primary filer, IRS estimated that more than 90
percent of the returns also reported wage income.

documentation as proof of identity at an IRS taxpayer assistance site.
After we obtained an ITIN through the mailed application, we used it to
open a bank account and obtain an ATM card. We did not receive the ITIN
from the application submitted at the walk-in site because we already
received an ITIN for that individual through the mailed application; IRS
apparently followed its procedure to not issue multiple ITINs to the same
individual.

We also created a bogus ITIN displayed on a fake ITIN card. We used the
bogus ITIN in lieu of a required SSN to obtain a Virginia voter
registration card. Virginia requires an SSN to register to vote but
presumably voter registration officials did not verify the number we put
on the application.12 Only U.S. citizens are eligible to obtain a voter
registration card. We were twice unsuccessful in using the bogus ITIN to
open a bank account in the District of Columbia. Officials at both banks
told our staff that they could not validate this ITIN based on their
access to a credit reporting agency database.

Our test of IRS's ITIN issuance controls and whether an individual can use
an ITIN for nontax purposes was too limited to show the extent to which
ITIN issuance controls prevent improperly issued ITINs. Nor does the test
show the magnitude of any abuse, in either receiving ITINs under false
pretenses or using them for nontax purposes. Rather, the test indicates
that IRS's ITIN process and controls could be circumvented, and that a
person who obtains an ITIN using bogus documentation may have little
difficulty in using the ITIN for certain nontax purposes.

Although IRS revised its procedures for issuing ITINs subsequent to our
test, the changes made do not completely address the control weaknesses we
exploited. On one hand, IRS staff will need to review fewer types of
documents and will be further trained in 2004 on document validation and
document inspection equipment to help identify questionable documents.
Also, because IRS switched to a letter from an SSN-like card to help
clarify that the issued ITIN is not an SSN, using an ITIN to obtain other
documents may be more difficult. On the other hand, IRS will neither
require applicants to appear in person nor verify documents with third
parties such as the country issuing them. Thus, IRS remains limited in its
ability to

12Given the limited time to do our work, our test only included Virginia.
We do not know whether other states also would have issued us a voter
registration card in this manner. Since we did our test, Virginia has
announced changes to strengthen its checks of identification documentation
such as for a driver's license.

ensure that the documents submitted with an ITIN application are valid and
that the applicant is the same individual described by those documents.

IRS officials said that requiring ITIN applicants to apply in-person and
verifying documents with third parties would pose challenges, such as
significantly delaying the issuance of ITINs and processing of returns
that are now to be attached to ITIN applications. According to IRS,
requiring inperson appearances would significantly burden IRS and
applicants for various reasons. First, IRS locations that accept
applications do not have the capacity, space or staffing to handle the
increased ITIN traffic. Second, not all ITIN applicants live near such IRS
locations and those in foreign countries would have virtually no place to
go. Third, assistance to customers with other tax issues would be
diminished, particularly when the ITIN workload now only represents about
7 percent of the customers assisted. IRS also noted that verifying
identification documents would be burdensome on customers and costly for
IRS, particularly when a significant proportion of the documents come from
foreign sources.

  Difficult Issues Arise When Illegal Resident Aliens Receive ITINS, Become
  Employed, and Receive Wage Income

Because many ITINs are provided to aliens who are not authorized to work
but who nevertheless do, employers and government agencies face many
difficult issues. Often, these issues center on what role employers and
agencies have, or should have, in furthering the federal policy that
immigrants should only be in the United States legally.

Employees who are illegal resident aliens likely provide employers
inaccurate TINs, which could be either SSNs or ITINs. In this context,
employers' concerns that they might be penalized if they provide
inaccurate wage reports to IRS and SSA appear largely unfounded if they do
what they are required to do. Employers also appear to have been concerned
about what they are expected to do under the government's broader policies
on illegal immigration. However, if employers do what is required in
verifying the identity and work eligibility of employees, they appear to
limit the likelihood of needing to take additional actions under DHS
guidance related to possible illegal resident aliens.

When illegal resident aliens obtain employment and earn wages, IRS has
data that could provide DHS enhanced information to use in targeting its
enforcement efforts. However, to differing degrees, officials cite limited
resources, other data sources available to them, legal restrictions, and
potential impact on voluntary compliance as factors affecting their
decisions about whether and how to share data.

Tax Returns Using ITINs Often Involve Illegal Resident Aliens and Their
Associated Wage Statements Likely Show Up in SSA's Earnings Suspense File

IRS and TIGTA have concluded that many of the taxpayers who file tax
returns with ITINs are illegal resident aliens. Although estimates are not
precise, according to TIGTA, hundreds of thousands of the tax returns
filed with ITINs each year likely involve employed illegal resident
aliens. Because a substantial portion of these returns have forms W-2
attached with SSNs as the identifying number, they likely lead to hundreds
of thousands of new records being added annually to SSA's earnings
suspense file-a large and growing file of wage earnings for which SSA
cannot identify the owner.

In a December 2003 letter that responded to a TIGTA report,13 IRS
concluded that most resident aliens who have ITINs and also report wage
income were not legally employed in the United States because they used an
ITIN instead of a valid SSN on their tax returns. If these individuals had
qualified for an SSN, they would not need to file with an ITIN. Further,
IRS said that it believes that most ITIN holders whose wages are reported
on Forms W-2 are using stolen or fabricated SSNs.

In this report, TIGTA had estimated for tax year 2000 that 353,000
resident aliens who were not authorized to work in the United States filed
a tax return with an ITIN and also reported wages. TIGTA concluded that
these individuals likely were unauthorized resident aliens (i.e., illegal
resident aliens) since they did not use an SSN as their identifying number
on the tax return. TIGTA estimated that at least 265,000 of these returns
had Forms W-2 attached that did not use valid SSNs.

These illegal resident aliens can contribute to the size of SSA's earnings
suspense file when they work and provide their employers an incorrect
identification number and/or name. New employees are supposed to fill out
an IRS Form W-4 (Employee's Withholding Allowance Certificate) when they
begin employment to identify how many, if any, exemptions to claim for
income tax withholding, and must provide their name and SSN. The employer
uses the W-4 information to help complete a Form W-2 to report wages the
employee earned and the amount withheld for income tax purposes for the
calendar year. The Form W-2 is sent to SSA, which uses the form to record
the employee's earnings for use in determining future benefits. After
recording the wages, SSA forwards the Form W-2

13Internal Revenue Service's Individual Taxpayer Identification Number
Creates Significant Challenges for Tax Administration, Treasury Inspector
General for Tax Administration, Jan. 2004, Reference Number 2004-30-023.

information to IRS so that IRS can match the wages reported on the W-2 to
those reported by the taxpayer on a tax return.

If an illegal resident alien provides an ITIN or an SSN (someone else's or
an SSN-like number that was made up) on the W-4 and the employer records
the name and number on a W-2 form, those numbers will show up as
"mismatches" when SSA attempts to validate that the employee's name and
number match those in SSA's records. In these cases, SSA posts a record of
the wage earnings into its suspense file.

Although it is difficult to compute their precise impact, ITIN mismatches
represent a very small portion of the postings to the earnings suspense
file since it was created and since the ITIN was created. Based on a
preliminary analysis in 2002 of SSA data for 1996 (when the ITIN was
created) through 2000 (the most recent year of available data then), the
suspense file contained roughly 119,000 numbers that looked like ITINs14
and wages of about $936 million. The entire file contained over 230
million postings and more than $365 billion in uncredited wages through
2000. For those same years (1996 through 2000), about 38 million
additional postings (with about $166 billion in wages) entered the
suspense file.15 Thus, the initial computation of about 119,000 numbers
with wages reported under likely ITINs represented about 0.3 percent of
new postings and about 0.6 percent of new wages added to the suspense file
between 1996 and 2000.

Illegal resident aliens' use of SSNs that are not valid for employment
purposes likely accounts for more of the growth in SSA's suspense file
than does their use of ITINs. We did not attempt to compute the growth in
the suspense file that may be due to illegal resident aliens improperly
using an SSN. However, as discussed earlier, for tax year 2000, TIGTA
estimated that at least 265,000 tax returns16 had W-2s attached that used
invalid SSNs, which is higher than the 119,000 likely ITINs in the
suspense file since 1996.

14We did not confirm that each Form W-2 actually reported an ITIN because
we did not cross match the SSA records with an IRS file of issued ITINs.
Rather, we counted all numbers in the suspense file that appeared to be an
ITIN due to their ITIN-like format.

15For a number of reasons, the number of suspense file accounts fluctuates
daily, making a precise count difficult. While new accounts enter the
suspense file, others are withdrawn. SSA has the ability to resolve
certain types of identification problems for some of the accounts. Also,
individuals come to SSA to report errors in their earnings records. These
numbers on the accounts in the suspense file cover through tax year 2000,
as of November 2003.

If Employers Do What Is Required, They Appear to Face Little Likelihood of
Being Penalized

Employers' concerns about potentially being penalized by IRS if they
submit inaccurate wage reports-which can occur when illegal resident
aliens provide them ITINs or SSNs upon obtaining employment--appear to be
largely unfounded if employers do what is required. Further, if employers
do what is required of them, they also appear to minimize their
responsibilities to take additional actions under DHS regulations related
to possible illegal resident aliens.

Employers have responsibilities to IRS, SSA, and DHS when they hire
employees. In addition to the Forms W-4 and W-2 responsibilities,
employers are responsible under DHS regulations for verifying employees'
identity and employment eligibility. Employers must ensure that employees
fill out a DHS Form I-9 (Employment Eligibility Verification Form) when
they start work. Employers must review documents provided by employees
establishing their identity and eligibility to work and retain the Form
I-9 for 3 years after a person begins work or 1 year after a person's
employment is terminated.

Pursuant to your interest, we contacted two groups that represent
employers to better understand what concerns, if any, they may have about
their responsibilities to these agencies. Officials from those groups did
not provide us any examples where the guidance of IRS, SSA, and DHS were
directly in conflict.

However, based on our review of two IRS letters,17 it appeared that some
employers may have believed that (1) they had greater responsibilities
than they actually do under IRS guidance and those perceived
responsibilities might lead to penalties, and (2) following one agency's
advice may put them at risk with another agency. Representatives of one of
the employer groups we spoke with said that IRS's responses, as partially
described below, allayed their concerns by clarifying actions employers
are required to undertake.

16In its report, TIGTA stated that computed the margin of error for this
estimate was plus or minus 17,732.

17On July 24, 2002, the American Society for Payroll Management sent a
letter and IRS responded to their concerns on January 13, 2003. A set of
follow-up questions produced another IRS response on September 23, 2003.

The Information Reporting Program Advisory Committee (IRPAC), which
represents those (such as employers) who have interests in IRS's
information returns programs, asked IRS about any advantage or
disadvantage to using IRS's TIN matching program or SSA's SSN verification
systems18 for purposes of information reporting accuracy penalties.19 The
inference from this question appeared to be that some employers believed
they were required or expected to use these systems to verify that the SSN
provided by an employee was correct. IRS's response clarified that (1) the
TIN-matching program was not available to employers for this purpose due
to statutory restrictions and (2) employers only have to ask an employee
fill out a Form W-4 and then can rely on the SSN as provided on that form.
IRS clarified that under its rules employers have no responsibility to
verify the accuracy of the SSN provided by the employee.

In general, IRS informed employers that they must solicit an SSN from the
employee when the employee is hired by having the employee fill out a Form
W-4. The employer should retain the Form W-4 in its records and use the
SSN provided on the Form W-4 when completing a W-2 to report wages paid to
the employee. If IRS subsequently notifies the employer that the SSN is
invalid, the employer may need to solicit an SSN from the employee once or
twice more. The employer may rely on the SSN provided by the employee with
no further verification.

The employers' questions to IRS also implied that they were concerned that
fulfilling their responsibilities to IRS might create the need to take
action to comply with DHS requirements. In its letter to IRS, IRPAC noted
that federal immigration representatives had told some employers that if
an employer used SSA's SSN verification system or IRS's TIN matching
program, a mismatch notice would constitute constructive notice of a
possible work authorization issue. In general, if questions arise about an
employee's work authorization, DHS guidance provides that an employer
might need to take certain actions, such as providing the employee another
opportunity to provide proper Form I-9 documentation. We did not verify

18TIN Matching is an IRS program that allows payers who submit certain
information returns subject to backup withholding taxes when the payee
does not provide a TIN to match payee TIN and name combinations against
IRS records prior to submitting information returns. SSA's verification
system is a system that employers may choose to use in an effort to verify
that an SSN matches a given individual's name.

1926 U.S.C. S:6721 provides for a penalty for failure to file a complete
and accurate information return, including a failure to include the
correct TIN (or SSN). The penalty is $50 per return up to $250,000 per
year.

whether a mismatch could be constructive notice of a work authorization
issue. However, because employers cannot use the TIN matching program for
this purpose and are not required to use SSA's SSN verification system,
employers can avoid possibly having constructive notice of a work
authorization issue by simply not verifying an employee's identity.

Greater Data Sharing Regarding ITIN Taxpayers Might Help DHS Identify
Illegal Immigrants, But Several Issues Affect Any Decision to Increase
Data Sharing

Enhanced sharing of IRS data might help DHS in addressing illegal
immigration, but whether and how to share data is a complex policy issue.
Such data sharing could provide DHS additional information to use in
targeting its enforcement efforts. However, to differing degrees,
officials cite limited resources, other data sources available to them,
legal restrictions, and potential impact on voluntary compliance as
factors affecting their decisions about whether and how to share data.

Among IRS's principal responsibilities, IRS is to ensure that all
taxpayers meet their tax obligations, including illegal resident aliens
who are not authorized to work in the United States but who have a tax
obligation. Among SSA's responsibilities is ensuring that individuals who
have paid social security taxes on their covered earnings receive credit.
Such credit is important so that workers will receive the benefits to
which they are entitled based on their work, even persons with such
earnings from unauthorized work. In addition to other responsibilities,
DHS is responsible for enforcing the nation's immigration laws, including
deterring illegal immigration and locating and deporting illegal resident
aliens.

As discussed earlier, IRS data may identify hundreds of thousands of
individuals who are likely to be illegal resident aliens. Individuals who
obtain ITINs and report wage income on a tax return may be illegal
resident aliens. IRS has data that could be used to identify illegal
resident aliens and/or their employers. The data would include such
specifics as an individual's name, address, and place(s) of employment in
the last calendar year.

Although DHS officials we spoke with said that IRS data might be useful in
carrying out their responsibilities, they noted that they have other
sources of data on illegal immigrants and have limited resources to pursue
all potential leads on illegal immigration. Further, they recognized that
current statutory restrictions on sharing tax data would need to be
modified to permit sharing of IRS data with them.20

IRS officials similarly noted a number of issues that relate to increasing
data sharing among the agencies. IRS officials said that they cannot share
these data with DHS under current statutory restrictions on the sharing of
tax data. IRS officials also said that any consideration of additional
sharing of tax data with federal agencies requires substantial
justification and should be considered in rare circumstances because the
confidentiality of tax data is considered to be fundamental to taxpayers'
willingness to voluntarily and accurately report their tax obligations.
Finally, IRS officials also noted a potential adverse effect of increased
data sharing. To the extent that illegal resident aliens become aware of
greater sharing of information by IRS with other agencies, some of the
individuals may move into "underground" jobs and avoid their tax
obligations. Thus, IRS faces a fundamental tension in considering steps
that might further other agencies' achievement of their missions but that
potentially undercut IRS's ability to ensure that all taxpayers,
regardless of their legal immigration status, meet their tax obligations.

  Concluding Observations

IRS's creation of the ITIN helped it resolve several tax administration
challenges. However, in creating the ITIN, IRS opened an avenue for
individuals to use to establish an identity and to blend into society.
IRS's controls over the issuance of ITINs have been limited and
consequently, we had little difficulty obtaining an ITIN with bogus
documents and then using that ITIN, as well as a completely made up ITIN,
to take additional steps to blend into society. IRS's recent efforts to
improve its ITIN issuance process-which changed the application procedures
from those we tested-might make it somewhat more difficult to obtain an
ITIN with bogus information but do not fully address the weaknesses we
exploited.

Because a significant but not precisely known number of ITIN holders are
illegal resident aliens, tax return data that IRS receives could
potentially assist DHS in carrying out enforcement of immigration laws.
However, agency officials have not aggressively sought to enhance data
sharing, citing limited resources, legal restrictions, and possible
voluntary compliance impacts. Changing the current statutory provisions
that limit the sharing of tax-related data with agencies or emphasizing
enhanced

20Section 6103 of the Internal Revenue Code allows IRS to disclose
taxpayer information to federal agencies and authorized employees of those
agencies, but only under specific conditions. Section 6103 does not
currently authorize data sharing between IRS and DHS specifically for
immigration enforcement.

efforts by IRS, SSA, and DHS to address the presence of illegal resident
aliens are difficult policy issues. For instance, to what extent would
increased data sharing undermine the willingness of taxpayers to
voluntarily and accurately report information IRS needs to administer tax
laws? What priority should these agencies place on addressing illegal
resident aliens versus their other responsibilities? Given the legal,
budgetary, and policy issues attendant to increased data sharing, this
hearing is one opportunity for Congress to consider whether to provide new
guidance to the agencies on how to proceed.

Messrs. Chairman, this concludes my prepared statement. I would be happy
to respond to any questions you or other Members of the Subcommittees may
have at this time.

For further information on this testimony, please contact Michael Brostek
at (202 512-9110) or [email protected]. Individuals making key
contributions to this testimony include George Guttman, Jay Pelkofer, and
Tom Short.

This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed in
its entirety without further permission from GAO. However, because this
work may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this material
separately.

GAO's Mission	The General Accounting Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in meeting its
constitutional responsibilities and to help improve the performance and
accountability of the federal government for the American people. GAO
examines the use of public funds; evaluates federal programs and policies;
and provides analyses, recommendations, and other assistance to help
Congress make informed oversight, policy, and funding decisions. GAO's
commitment to good government is reflected in its core values of
accountability, integrity, and reliability.

  Obtaining Copies of GAO Reports and Testimony

The fastest and easiest way to obtain copies of GAO documents at no cost
is through the Internet. GAO's Web site (www.gao.gov) contains abstracts
and fulltext files of current reports and testimony and an expanding
archive of older products. The Web site features a search engine to help
you locate documents using key words and phrases. You can print these
documents in their entirety, including charts and other graphics.

Each day, GAO issues a list of newly released reports, testimony, and
correspondence. GAO posts this list, known as "Today's Reports," on its
Web site daily. The list contains links to the full-text document files.
To have GAO e-mail this list to you every afternoon, go to www.gao.gov and
select "Subscribe to e-mail alerts" under the "Order GAO Products"
heading.

Order by Mail or Phone	The first copy of each printed report is free.
Additional copies are $2 each. A check or money order should be made out
to the Superintendent of Documents. GAO also accepts VISA and Mastercard.
Orders for 100 or more copies mailed to a single address are discounted 25
percent. Orders should be sent to:

U.S. General Accounting Office 441 G Street NW, Room LM Washington, D.C.
20548

To order by Phone: 	Voice: (202) 512-6000 TDD: (202) 512-2537 Fax: (202)
512-6061

  To Report Fraud, Contact:

Web site: www.gao.gov/fraudnet/fraudnet.htmWaste, and Abuse in E-mail:
[email protected] Federal Programs Automated answering system: (800)
424-5454 or (202) 512-7470

Public Affairs	Jeff Nelligan, Managing Director, [email protected] (202)
512-4800 U.S. General Accounting Office, 441 G Street NW, Room 7149
Washington, D.C. 20548
*** End of document. ***